Publish compiled binaries with new releases

[philknows]

In order to help reduce or mitigate the risks which come from building Lodestar locally (example: NPM), this proposal is to add binary releases to our release process. This will simplify and reduce the risks of running Lodestar bare metal on Linux.

All the other 4 mainnet clients do this currently and we should add this as part of moving Lodestar to a production-ready client.

TO-DO:

• Research bundling nodeJS apps
• Start publishing new releases with a .tar.gz binary for AMD64 infrastructure.
• Publish binaries with checksum for verification of bundle.

[philknows]

Will any of these suffice @dapplion ? I think it's important to figure this out to help reduce the risks of NPM or building from source.

https://github.com/nexe/nexe
https://github.com/leafac/caxa
https://nectar.js.org/

[wemeetagain]

I appreciate the simplicity and approach of caxa.

In the mean time, our docker image gives users something similar (guards against installation-time npm risks).
While this is in progress, we can update our docs to recommend docker, or call out this benefit or the problem/risk explicitly.

[philknows]

@wemeetagain Would it be difficult for us to implement this as part of the releases that we do so we push binaries alongside the source code .zip/.tar.gz? I'm thinking something similar to what Prysm does for their releases.

I agree, documentation update to recommend docker would be a key change to make.

[philknows]

Error from Windows on CI build with caxa:

C:\Users\Phil-ChainSafe\Downloads>lodestar-windows-next.exe
C:\Users\PHIL-C~1\AppData\Local\Temp\caxa\applications\lodestar-windows-next\eirrbjsq6f\1\node_modules.bin\lodestar:2
basedir=$(dirname "$(echo "$0" | sed -e 's,\,/,g')")
^^^^^^^

SyntaxError: missing ) after argument list
←[90m at Object.compileFunction (node:vm:352:18)←[39m
←[90m at wrapSafe (node:internal/modules/cjs/loader:1031:15)←[39m
←[90m at Module._compile (node:internal/modules/cjs/loader:1065:27)←[39m
←[90m at Object.Module._extensions..js (node:internal/modules/cjs/loader:1153:10)←[39m
←[90m at Module.load (node:internal/modules/cjs/loader:981:32)←[39m
←[90m at Function.Module._load (node:internal/modules/cjs/loader:822:12)←[39m
←[90m at Function.executeUserEntryPoint [as runMain] (node:internal/modules/run_main:81:12)←[39m
←[90m at node:internal/main/run_main_module:17:47←[39m

[dapplion]

basedir=$(dirname "$(echo "$0" | sed -e 's,,/,g')")

Where is this coming from? I don't see this in the codebase

[wemeetagain]

I think this is coming from caxa

[philknows]

@wemeetagain , I spoke to @mpetrunic today and he has some experience using https://github.com/vercel/pkg for packaging up node applications if you wanted to give this one a try instead.

[wemeetagain]

• prerequisite for Add support for Personal Package Archive (PPA) installation of Lodestar #4177